- 论坛徽章:
- 0
|
我的FreeBSD+ipfilter随机冻结,请大家帮我诊断一下原因
回复james_h 朋友的问题：
1，反正在上网的过程中要冻结，没任何先兆和提示，但在单位测试没任何问题，开一天都没问题
2，冻结的时候没任何输出和提示，用syslog没用，因为我就用它来做日志
3，用的DOM电子盘，是只读的，不会有日志
4，核心配置很平常是：
machine i386
#cpu I386_CPU
#cpu I486_CPU
cpu I586_CPU
cpu I686_CPU
ident firewall
maxusers 0
makeoptions KERNEL=fw.586
options INET #InterNETworking
options FFS #Berkeley Fast Filesystem
options FFS_ROOT #FFS usable as root device [keep this!]
options MFS #Memory Filesystem
options MD_ROOT #MD is a potential root device
options PROCFS #Process filesystem
options COMPAT_43 #Compatible with BSD 4.3 [KEEP THIS!]
options P1003_1B #Posix P1003_1B real-time extensions
options _KPOSIX_PRIORITY_SCHEDULING
options ICMP_BANDLIM #Rate limit bad replies
options KBD_INSTALL_CDEV #install a CDEV entry in /dev
options SYSVMSG
options MSGMNB=8192 # max # of bytes in a queue
options MSGMNI=40 # number of message queue identifiers
options MSGSEG=512 # number of message segments per queue
options MSGSSZ=64 # size of a message segment
options MSGTQL=2048 # max messages in system
options PANIC_REBOOT_WAIT_TIME=4
options VM_KMEM_SIZE_SCALE="2"
options IPFILTER #ipfilter support
options IPFILTER_DEFAULT_BLOCK #block all packets by default
options IPFILTER_LOG
options TCP_DROP_SYNFIN #drop TCP packets with SYN+FIN
options IPSTEALTH #支持秘密IP转发
options RANDOM_IP_ID #随机IP ID，阻止信息泄漏
options BRIDGE
options NMBCLUSTERS=4096
options NO_SWAPPING
options DEVICE_POLLING #改善网络响应时间，但realtek不支持
options HZ=1000
options NETGRAPH
options NETGRAPH_PPPOE
options NETGRAPH_SOCKET
options NETGRAPH_ETHER
options NETGRAPH_IFACE
options NETGRAPH_PPP
options NETGRAPH_BPF
options NETGRAPH_VJC
options NETGRAPH_KSOCKET
options NETGRAPH_PPTPGRE
options NETGRAPH_L2TP
options NETGRAPH_TTY
options NETGRAPH_MPPC_ENCRYPTION
options NETGRAPH_ONE2MANY
options IPSEC
options IPSEC_ESP
device isa
device pci
# ATA and ATAPI devices
device ata
device atadisk #ATA disk drives
options ATA_STATIC_ID
# atkbdc0 controls both the keyboard and the PS/2 mouse
device atkbdc0 at isa? port IO_KBD
device atkbd0 at atkbdc? irq 1 flags 0x1
device vga0 at isa?
options VGA_NO_FONT_LOADING # 不需要保存/加载字体[节省内存]
options VGA_NO_MODE_CHANGE # 不需要修改显示模式[节省内存]
# syscons is the default console driver, resembling an SCO console
device sc0 at isa? flags 0x100
options MAXCONS=1 # 不需要更多的控制台
options SC_DISABLE_REBOOT # 禁止Ctrl+Alt+Del重启，必须以root登录。
options SC_NO_CUTPASTE # 禁用剪贴板[节省内存]
options SC_NO_FONT_LOADING # 禁用字体加载[节省内存]
options SC_NO_SYSMOUSE # 禁用鼠标[节省内存]
# Floating point support - do not disable.
device npx0 at nexus? port IO_NPX irq 13
# Serial (COM) ports
device sio0 at isa? port IO_COM1 flags 0x10 irq 4
device sio1 at isa? port IO_COM2 irq 3
# PCI Ethernet NICs that use the common MII bus controller code.
# NOTE: Be sure to keep the 'device miibus' line in order to use these NICs!
device miibus # MII bus support
#device dc # DEC/Intel 21143 and various workalikes
device fxp # Intel EtherExpress PRO/100B (82557, 8255
#device pcn # AMD Am79C97x PCI 10/100 NICs
device rl # RealTek 8129/8139
#device sf # Adaptec AIC-6915 (``Starfire'')
#device sis # Silicon Integrated Systems SiS 900/SiS 7016
#device ste # Sundance ST201 (D-Link DFE-550TX)
#device tl # Texas Instruments ThunderLAN
#device tx # SMC EtherPower II (83c170 ``EPIC'')
#device vr # VIA Rhine, Rhine II
#device wb # Winbond W89C840F
#device wx # Intel Gigabit Ethernet Card (``Wiseman'')
#device xl # 3Com 3c90x (``Boomerang'', ``Cyclone'')
#device bge # Broadcom BCM570x (``Tigon III'')
#device de
# ISA Ethernet NICs.
# 'device ed' requires 'device miibus'
device ed0 at isa? port 0x280 irq 10 iomem 0xd8000
#device ex
#device ep
#device fe0 at isa? port 0x300
# Xircom Ethernet
#device xe
# The probe order of these is presently determined by i386/isa/isa_compat.c.
device lnc0 at isa? port 0x280 irq 10 drq 0
# Pseudo devices - the number indicates how many units to allocate.
pseudo-device loop # Network loopback
pseudo-device ether # Ethernet support
pseudo-device ppp # Kernel PPP
pseudo-device tun # Packet tunnel.
pseudo-device pty # Pseudo-ttys (telnet etc)
pseudo-device md # Memory "disks"
pseudo-device gif # IPv6 and IPv4 tunneling
pseudo-device vlan
# The `bpf' pseudo-device enables the Berkeley Packet Filter.
# Be aware of the administrative consequences of enabling this!
pseudo-device bpf #Berkeley packet filter
后面包括网卡polling我都去掉了，还是这样 |
|
免费注册
发表于 2004-07-22 11:24
发表于 2004-07-22 14:57